Description: Template to create a ClickHouseAccess Bring Your Own Account Setup
Parameters:
  ExternalID:
    Type: String
    Description: Unique identifier used to enhance security and prevent unauthorised role assumptions
  IncludeVPCWritePermissions:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
    Description: Whether to create ClickHouseManagementRole with VPC write permissions (set to false for BYOVPC)
  IncludeIAMWritePermissions:
    Type: String
    Default: "true"
    AllowedValues:
      - "true"
      - "false"
    Description: Whether to create ClickHouseManagementRole with IAM (Roles & Policies) write permissions
Conditions:
  IncludeVPCWritePermissionsCondition:
    Fn::Equals:
      - Ref: IncludeVPCWritePermissions
      - "true"
  IncludeIAMWritePermissionsCondition:
    Fn::Equals:
      - Ref: IncludeIAMWritePermissions
      - "true"
Resources:
  ClickHouseManagementRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::426924874929:root
            Action: sts:AssumeRole
            Condition:
              StringLike:
                aws:PrincipalArn:
                  - arn:aws:iam::426924874929:role/*-CrossplaneWorkloadRole
              StringEquals:
                sts:ExternalId:
                  Ref: ExternalID
      Description: Role to allow ClickHouse Cloud to manage resources in your account
      RoleName: ClickHouseManagementRole
      Tags:
        - Key: clickhouse-byoc
          Value: "true"
        - Key: version
          Value: 2.0.206-928e359
    DeletionPolicy: Delete
  RolePolicyBasePolicy:
    Type: AWS::IAM::RolePolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - sts:GetCallerIdentity
            Resource:
              - "*"
      PolicyName: BasePolicy
      RoleName: ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
  IAMBaseManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Base IAM policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-IAM-Base-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - iam:GetPolicy
              - iam:GetPolicyVersion
              - iam:ListPolicyVersions
            Resource:
              - arn:aws:iam::*:policy/*
          - Effect: Allow
            Action:
              - iam:GetRole
              - iam:ListRolePolicies
              - iam:ListInstanceProfilesForRole
              - iam:GetRolePolicy
              - iam:ListAttachedRolePolicies
            Resource:
              - arn:aws:iam::*:role/*
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource:
              - arn:aws:iam::*:role/*-k8s-control-plane
            Condition:
              StringEquals:
                iam:PassedToService: eks.amazonaws.com
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource:
              - arn:aws:iam::*:role/*-load-balancer-controller
              - arn:aws:iam::*:role/*-cluster-autoscaler
              - arn:aws:iam::*:role/*-CH-S3-Role
              - arn:aws:iam::*:role/*-state-exporter
              - arn:aws:iam::*:role/*-thanos
              - arn:aws:iam::*:role/*-ebs-csi-driver
            Condition:
              StringEquals:
                iam:PassedToService: pods.eks.amazonaws.com
          - Effect: Allow
            Action:
              - iam:PassRole
            Resource:
              - arn:aws:iam::*:role/*-k8s-worker
            Condition:
              StringEquals:
                iam:PassedToService:
                  - ec2.amazonaws.com
                  - eks.amazonaws.com
          - Effect: Allow
            Action:
              - iam:CreateServiceLinkedRole
            Resource:
              - arn:aws:iam::*:role/*
            Condition:
              StringEquals:
                iam:AWSServiceName:
                  - eks.amazonaws.com
                  - eks-nodegroup.amazonaws.com
          - Effect: Allow
            Action:
              - iam:GetOpenIDConnectProvider
            Resource:
              - arn:aws:iam::*:oidc-provider/*
          - Effect: Allow
            Action:
              - iam:TagOpenIDConnectProvider
              - iam:UntagOpenIDConnectProvider
              - iam:UpdateOpenIDConnectProviderThumbprint
              - iam:DeleteOpenIDConnectProvider
            Resource:
              - arn:aws:iam::*:oidc-provider/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - iam:CreateOpenIDConnectProvider
              - iam:TagOpenIDConnectProvider
            Resource:
              - arn:aws:iam::*:oidc-provider/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - iam:ListInstanceProfilesForRole
            Resource:
              - arn:aws:iam::*:instance-profile/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
  IAMExtendedManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Extended IAM policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-IAM-Extended-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - iam:CreatePolicy
              - iam:TagPolicy
            Resource:
              - arn:aws:iam::*:policy/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - iam:DeletePolicy
              - iam:CreatePolicyVersion
              - iam:DeletePolicyVersion
            Resource:
              - arn:aws:iam::*:policy/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - iam:CreateRole
              - iam:TagRole
            Resource:
              - arn:aws:iam::*:role/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - iam:AttachRolePolicy
              - iam:DetachRolePolicy
              - iam:UpdateRole
              - iam:UpdateRoleDescription
              - iam:DeleteRole
              - iam:UpdateAssumeRolePolicy
              - iam:TagRole
              - iam:UntagRole
              - iam:PutRolePolicy
              - iam:DeleteRolePolicy
            Resource:
              - arn:aws:iam::*:role/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - iam:RemoveRoleFromInstanceProfile
            Resource:
              - arn:aws:iam::*:instance-profile/*
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
    Condition: IncludeIAMWritePermissionsCondition
  S3ManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: S3 policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-S3-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:GetBucketAcl
              - s3:GetBucketCors
              - s3:GetBucketLogging
              - s3:GetBucketObjectLockConfiguration
              - s3:GetBucketPolicy
              - s3:GetReplicationConfiguration
              - s3:GetEncryptionConfiguration
              - s3:GetBucketRequestPayment
              - s3:GetBucketTagging
              - s3:GetBucketVersioning
              - s3:GetBucketWebsite
              - s3:GetBucketOwnershipControls
              - s3:GetBucketPublicAccessBlock
              - s3:GetAccelerateConfiguration
              - s3:PutBucketTagging
              - s3:PutLifecycleConfiguration
              - s3:PutBucketOwnershipControls
              - s3:PutBucketPublicAccessBlock
              - s3:PutEncryptionConfiguration
              - s3:GetMetricsConfiguration
              - s3:PutMetricsConfiguration
              - s3:CreateBucket
              - s3:ListBucket
              - s3:GetLifecycleConfiguration
            Resource:
              - arn:aws:s3:::*.*.aws.clickhouse.cloud-shared
              - arn:aws:s3:::*.*.aws.clickhouse.cloud-backup
              - arn:aws:s3:::*.*.aws.clickhouse.cloud-monitoring
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
  EKSManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: EKS policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-EKS-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - eks:CreateAddon
              - eks:CreateCluster
              - eks:DeleteCluster
              - eks:DeleteAddon
              - eks:DeleteNodegroup
              - eks:CreateNodegroup
              - eks:UpdateAddon
              - eks:UpdateNodegroupVersion
              - eks:UpdateNodegroupConfig
              - eks:UpdateClusterConfig
              - eks:UpdateClusterVersion
              - eks:AssociateEncryptionConfig
              - eks:CreatePodIdentityAssociation
              - eks:TagResource
              - eks:UntagResource
            Resource:
              - arn:aws:eks:*:*:cluster/clickhouse-cloud-*
              - arn:aws:eks:*:*:addon/clickhouse-cloud-*
              - arn:aws:eks:*:*:nodegroup/clickhouse-cloud-*
          - Effect: Allow
            Action:
              - eks:DeletePodIdentityAssociation
              - eks:UpdatePodIdentityAssociation
              - eks:TagResource
              - eks:UntagResource
            Resource:
              - arn:aws:eks:*:*:podidentityassociation/clickhouse-cloud-*/*
          - Effect: Allow
            Action:
              - eks:List*
              - eks:Describe*
            Resource:
              - "*"
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
  RolePolicyKMSPolicy:
    Type: AWS::IAM::RolePolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - kms:DescribeKey
              - kms:CreateGrant
            Resource:
              - arn:aws:kms:*:381492293576:key/*
      PolicyName: KMSPolicy
      RoleName: ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
  EC2ManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: EC2 policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-EC2-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - ec2:Describe*
              - ec2:Get*
              - ec2:RunInstances
              - ec2:ModifyInstanceAttribute
              - ec2:ModifyNetworkInterfaceAttribute
              - elasticloadbalancing:Describe*
              - autoscaling:DescribeAutoScalingGroups
              - autoscaling:DescribeScalingActivities
            Resource:
              - "*"
          - Effect: Allow
            Action:
              - ec2:CreateTags
              - ec2:DeleteTags
            Resource:
              - "*"
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateTags
            Resource:
              - "*"
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:ModifyVolumeAttribute
            Resource:
              - arn:aws:ec2:*:*:volume/*
          - Effect: Allow
            Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupEgress
              - ec2:RevokeSecurityGroupIngress
              - ec2:DeleteSecurityGroup
              - ec2:ModifySecurityGroupRules
            Resource:
              - arn:aws:ec2:*:*:security-group/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:RevokeSecurityGroupEgress
              - ec2:RevokeSecurityGroupIngress
              - ec2:DeleteSecurityGroup
              - ec2:ModifySecurityGroupRules
            Resource:
              - arn:aws:ec2:*:*:security-group/*
            Condition:
              StringLike:
                aws:ResourceTag/aws:eks:cluster-name: clickhouse-cloud-*
          - Effect: Allow
            Action:
              - ec2:AuthorizeSecurityGroupEgress
              - ec2:AuthorizeSecurityGroupIngress
              - ec2:ModifySecurityGroupRules
            Resource:
              - arn:aws:ec2:*:*:security-group-rule/*
          - Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource:
              - arn:aws:ec2:*:*:vpc/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateSecurityGroup
            Resource:
              - arn:aws:ec2:*:*:security-group/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateLaunchTemplate
              - ec2:CreateLaunchTemplateVersion
              - ec2:ModifyLaunchTemplate
              - ec2:DeleteLaunchTemplate
            Resource:
              - arn:aws:ec2:*:*:launch-template/*
          - Effect: Allow
            Action:
              - ec2:AllocateAddress
            Resource:
              - arn:aws:ec2:*:*:elastic-ip/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:ReleaseAddress
            Resource:
              - arn:aws:ec2:*:*:elastic-ip/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
  VPCWriteManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: VPC Write policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-VPCWrite-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - ec2:CreateVpc
            Resource:
              - arn:aws:ec2:*:*:vpc/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:DeleteVpc
              - ec2:ModifyVpcAttribute
              - ec2:CreateSubnet
              - ec2:CreateRouteTable
            Resource:
              - arn:aws:ec2:*:*:vpc/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateSubnet
            Resource:
              - arn:aws:ec2:*:*:subnet/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:DeleteSubnet
              - ec2:ModifySubnetAttribute
            Resource:
              - arn:aws:ec2:*:*:subnet/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateNatGateway
            Resource:
              - arn:aws:ec2:*:*:natgateway/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateNatGateway
            Resource:
              - arn:aws:ec2:*:*:subnet/*
              - arn:aws:ec2:*:*:elastic-ip/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:DeleteNatGateway
            Resource:
              - arn:aws:ec2:*:*:natgateway/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateInternetGateway
            Resource:
              - arn:aws:ec2:*:*:internet-gateway/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:DeleteInternetGateway
            Resource:
              - arn:aws:ec2:*:*:internet-gateway/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:AssociateAddress
              - ec2:DisassociateAddress
            Resource:
              - arn:aws:ec2:*:*:elastic-ip/*
              - arn:aws:ec2:*:*:instance/*
              - arn:aws:ec2:*:*:network-interface/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:AttachInternetGateway
              - ec2:DetachInternetGateway
            Resource:
              - arn:aws:ec2:*:*:internet-gateway/*
              - arn:aws:ec2:*:*:vpc/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateRouteTable
            Resource:
              - arn:aws:ec2:*:*:route-table/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateRoute
              - ec2:DeleteRoute
              - ec2:DeleteRouteTable
            Resource:
              - arn:aws:ec2:*:*:route-table/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:AssociateRouteTable
              - ec2:DisassociateRouteTable
            Resource:
              - arn:aws:ec2:*:*:*/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateVpcEndpoint
            Resource:
              - arn:aws:ec2:*:*:vpc-endpoint/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateVpcEndpoint
            Resource:
              - arn:aws:ec2:*:*:vpc/*
              - arn:aws:ec2:*:*:subnet/*
              - arn:aws:ec2:*:*:security-group/*
              - arn:aws:ec2:*:*:route-table/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:ModifyVpcEndpoint
            Resource:
              - arn:aws:ec2:*:*:subnet/*
              - arn:aws:ec2:*:*:security-group/*
              - arn:aws:ec2:*:*:route-table/*
              - arn:aws:ec2:*:*:vpc-endpoint/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:DeleteVpcEndpoints
            Resource:
              - arn:aws:ec2:*:*:vpc-endpoint/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:CreateVpcEndpointServiceConfiguration
            Resource:
              - arn:aws:ec2:*:*:vpc-endpoint-service/*
            Condition:
              StringEquals:
                aws:RequestTag/clickhouse-byoc: "true"
          - Effect: Allow
            Action:
              - ec2:DeleteVpcEndpointServiceConfigurations
              - ec2:ModifyVpcEndpointServiceConfiguration
              - ec2:ModifyVpcEndpointServicePermissions
              - ec2:StartVpcEndpointServicePrivateDnsVerification
            Resource:
              - arn:aws:ec2:*:*:vpc-endpoint-service/*
            Condition:
              StringEquals:
                aws:ResourceTag/clickhouse-byoc: "true"
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete
    Condition: IncludeVPCWritePermissionsCondition
  CloudWatchManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: CloudWatch policy for ClickHouse Management Role
      ManagedPolicyName: ClickHouse-CloudWatch-Policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - logs:Tag*
              - logs:Untag*
              - logs:CreateLogGroup
              - logs:PutRetentionPolicy
              - logs:Get*
              - logs:Describe*
              - logs:List*
            Resource:
              - arn:aws:logs:*:*:log-group:*
      Roles:
        - ClickHouseManagementRole
    DependsOn:
      - ClickHouseManagementRole
    DeletionPolicy: Delete

